The most common thing that happens on a first sign in to a bought mailbox is a prompt asking you to verify it's you. It is not a ban, it is not proof the account is bad, and how you answer it in the next few minutes decides how the day goes. This guide covers what triggers it, the right response and the point at which you should stop and ask for a replacement instead.
What "verify it's you" actually is
Google watches the context of a sign in: the connection it comes from, the device and browser, and how that compares to the account's history. When a sign in does not look like the ones before it, you get an extra check rather than a straight refusal. That check might be a code to a recovery address, a tap on a signed in phone, a security question, or simply a message that it cannot verify you right now.
So a prompt means the sign in looked unfamiliar. On an account that has just changed hands, the sign in is unfamiliar, which is why this is the normal case rather than the exception.
What triggers it
| Trigger | How strong |
|---|---|
| Datacentre IP, hosting provider range | Very strong. The most reliable way to get a prompt. |
| A heavily used public VPN exit | Strong, for the same reason. |
| Signing in from a different country than the account's history | Strong |
| Several sign in attempts from different IPs in a row | Strong, and cumulative |
| A residential connection in the account's own region | Weak. This is what you want. |
| Changing every security setting in the first minutes | Moderate, and avoidable by waiting |
What to do when it appears
Slow down. Almost every bad outcome here comes from answering a verify it's you prompt in a hurry, from the wrong place, three times.
- Stay in the same session. Same IP, same browser, same tab if you can.
- Read what it is asking for. A code to the recovery address is answerable if the recovery email came with the account. A code to a phone number is not, if the number was never yours.
- Answer it once. If the option offered is one you can satisfy, do it.
- If you cannot satisfy it, stop. Close the tab and message the seller. Do not try again from somewhere else.
What not to do
- Do not retry from another IP. Each new context is another unfamiliar sign in on an account already under question, and the prompts get harder rather than easier.
- Do not cycle through browsers or devices. Same problem, faster.
- Do not start a recovery flow you cannot complete. A half finished recovery attempt is logged too.
- Do not change the password mid prompt. If you get in during a challenged session, confirm the inbox and leave the settings alone until the next day.
- Do not use a proxy to "look local" if it is a datacentre proxy. It is the strongest trigger there is; it will not help that it is in the right country.
Almost every account that is permanently lost after purchase is lost in the ten minutes after the first prompt, through retries. Stopping is a valid and usually the correct move.
When to ask for a replacement
Some verify it's you prompts are not answerable from your side at all, and recognising one early saves you an afternoon.
Ask, inside the replacement window agreed on your order, when:
- The prompt demands a code to a phone number you were never given.
- The account is already disabled or locked when you first try it.
- The recovery email was part of the order and the one delivered does not receive the code.
- The sign in is refused outright from a clean residential connection in the right region.
Send the Gmail address and a screenshot in the same chat. We check it and replace the account. What is not covered is a lock you reached through a datacentre proxy, through repeated retries from different IPs, or after the account had already been used. Our terms set that out plainly rather than in small print.
Reducing the odds before you buy
- Buy a region you can sign in from. The region guide explains why matching matters more than the label.
- Ask for the recovery email to be included. It makes most prompts answerable.
- Prefer aged stock. An account with history behind it attracts fewer checks than one created days ago.
- Consider a phone verified account if you have hit phone checks before. The PVA guide covers what that does and does not get you.
- Have the connection ready before the logins arrive, not after.
And once you are in, follow the security setup order, which is designed to produce as few of these prompts as possible.
Frequently asked questions
Why does Google keep asking me to verify it's you?
Because something about the sign in still does not match the account's own history, and repeating the sign in does not change that. The usual causes are a VPN or datacentre IP, a different country from the one the account was created in, or a browser that clears cookies between attempts so every sign in looks like the first. Fix the connection rather than retrying: one clean sign in from a steady residential line settles it far faster than five from the wrong place.
Does a verification prompt mean the account is banned?
No. It means the sign in looked unfamiliar, which is expected on an account that just changed hands. How you answer it matters more than the fact it appeared.
Can I just try again later from the same connection?
Often, yes, and that is far better than trying immediately from somewhere else. Same connection, same browser, a while later.
Google wants a code sent to a phone number I do not have. What now?
Stop there and message us inside the agreed window. Do not try variations, and do not guess at numbers: a run of failed attempts is itself a signal, and it turns a prompt you could have walked away from into a lock you cannot. The account gets replaced, which is the whole point of the window.
Will a residential proxy avoid the prompt?
A genuine residential connection in the account's region gives you the best chance. A datacentre proxy advertised as residential does the opposite, and it is the most common cause of a lock on a first sign in.
Is a prompt covered by the replacement window?
A prompt you cannot answer because the required method was never part of the order, yes. A lock you reached through retries or a datacentre proxy, no.
